Is CVE-2026-90437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90437 being exploited in the wild.

How severe is CVE-2026-90437?

High severity, with a CVSS score of 7.2, published 30 October 2026.

Which products and versions are affected?

Rocketgenius Gravity Forms up to and including 3.1.1.

Is there a fix for CVE-2026-90437?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90437 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90437?

Check whether you run Rocketgenius Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90437: Gravity Forms plugin stored cross-site scripting in field values

CVE-2026-90437 · Severity: high · CVSS 7.2 · Published 2026-10-30

Gravity Forms is a popular WordPress form builder plugin that allows site owners to create and manage web forms. A stored cross-site scripting vulnerability allows unauthenticated attackers to inject malicious scripts into form fields, which will execute whenever other users view pages containing the injected content. This could lead to account compromise, data theft, or malware distribution on affected WordPress sites.

Technologies: Rocketgenius Gravity Forms. Vendors: Rocketgenius.

Quick answers

Is CVE-2026-90437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90437 being exploited in the wild.
How severe is CVE-2026-90437?: High severity, with a CVSS score of 7.2, published 30 October 2026.
Which products and versions are affected?: Rocketgenius Gravity Forms up to and including 3.1.1.
Is there a fix for CVE-2026-90437?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90437 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90437?: Check whether you run Rocketgenius Gravity Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Post Excerpt, Post Custom Field, and Rich-Text Paragraph fields which allow raw HTML via allow_html(), and entity-encoded payloads stored in data-dialog-confirm attributes bypass wp_kses_post() sanitization at save time but are decoded and executed by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML(). This is a stored XSS requiring no user interaction, affecting all versions up to and including 3.1.1.

Affected products

Rocketgenius Gravity Forms up to and including 3.1.1

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.